Darkbloom sells inference from idle Apple Silicon Macs
Darkbloom connects API consumers to independent providers running models on Apple Silicon. Consumers use OpenAI-compatible chat, Responses, and completion endpoints or the Anthropic Messages shape. A Go coordinator authenticates, routes, bills, and relays requests. Providers maintain an outbound WebSocket connection, so they do not open an inbound port, then run MLX inference inside a hardened Swift process.
The proposition is unusual: spare Macs become paid inference nodes, while their owners should not be able to read prompts or responses. During public alpha the platform fee is 0 percent, and self-routing to a machine owned by the caller is free. Those commercial terms can change. More importantly, the README calls the project unaudited, warns of downtime and breaking changes, and says it is for testing rather than production.
The coordinator sees plaintext inside protected memory
A consumer reaches the coordinator over TLS and can optionally seal the request to its X25519 key. The coordinator decrypts inside a confidential VM for routing and billing, then re-encrypts the payload to an attested provider key with NaCl Box. Encrypted response chunks travel back through the coordinator. The documentation correctly avoids claiming that the coordinator never sees plaintext: it says exposure is transient inside hardware-encrypted VM memory and content is neither logged nor retained.
Provider protection combines in-process MLX inference, Hardened Runtime, SIP, debugger denial, Secure Enclave keys, MDM checks, Apple Managed Device Attestation, and APNs code-identity verification. Consumers receive headers describing trust, attestation, encryption, chip, and Secure Enclave status. These are architectural claims from the project, not an independent audit. Physical custody, coordinator software, Apple services, admission logic, and signed releases all remain in the trust chain.
What happened when we ran it
Our sandbox installed 463 Go packages in 69 seconds and built commit b66ee30 successfully in 78 seconds. The repository had 5,386 files, about 1,304,982 source lines, and occupied 84.5 MB. Eight CI workflow files were present; our scan found no Dockerfile and no top-level tests directory. The tree combines Go, Swift, TypeScript, shell scripts, documentation, and system-level test code.
The Go test command failed with exit code 1 after 128 seconds. It reported 34 passing package results and 3 failures out of 37. The failed names were TestIntegration_SwiftProviderRealRoutingGates, TestIntegration_ReferralRewardDistribution, and TestProfile_SingleProviderNonStreaming, all under the e2e package. Supporting testbed, assertion, and profile packages shown in the tail passed.
The excerpt does not include assertion messages, so it cannot establish whether the cause was environment, configuration, or code. A missing Dockerfile or tests directory also explains nothing about those failures. The fair conclusion is narrower: the Go build worked in a fresh 3-CPU, 8 GB Debian container without secrets, but this commit did not pass its complete detected test command.
Running a provider requires Apple hardware and external trust services
The minimum provider is an M1-or-newer Mac on macOS 14 with 8 GB of memory and 50 GB free disk. Startup rejects less than 8 GB, and the README recommends 32 GB or more for larger or multiple models. Models load only when weights plus roughly 2 GB of headroom fit after the operating-system reserve. Provider traffic needs outbound HTTPS on port 443.
The installer claims no prerequisites or sudo, then verifies release hashes and the Apple Developer ID signature, provisions a Secure Enclave helper, and offers MDM enrollment for hardware trust. Providers log in through a device-code flow. Stripe handles consumer deposits and Stripe Connect handles payouts. That is far more infrastructure than running MLX locally, and each external service can affect whether a healthy Mac is admitted or paid.
Current reports show that boundary is still moving. Issue 692 describes a Secure Enclave challenge sweep leaving a responsive provider unroutable for about 40 minutes until manual reconnection. Issue 744 reports a fully secured M5 Max remaining at self_signed after restart despite MDM responses. Issue 725 reports packaged safe-R1 kernels unavailable during installation. These reports fit the alpha label and deserve reproduction on candidate hardware.
Direct mode removes the marketplace from a local request
A provider can set a self-route header so the coordinator chooses only a machine owned by the same account. The request stays free, retains the encrypted relay, and fails explicitly if that Mac cannot serve it. A preference mode tries the owned machine first and falls back to the paid fleet. This is useful when one client should keep a familiar hosted endpoint but favor its own hardware.
Direct mode goes further. darkbloom start --local exposes an OpenAI-compatible endpoint on the reachable Mac and skips the coordinator, so it can work offline and keep bytes on the local network. For a single owner, that path removes billing and the coordinator plaintext boundary. Ollama or MLX LM remains simpler if attestation, marketplace compatibility, and the Darkbloom console are unnecessary.
Version 0.8.13 is moving too quickly for production trust
GitHub recorded 414 stars, 269 combined open issues and pull requests, and a last push on August 26, 2026. Provider v0.8.13 shipped the same day with signed and notarized macOS 14 artifacts. Its changes adjusted an earnings calculation, hid hardware serial numbers from public views, and fixed media handling for Qwen. The large combined queue is not a bug count, but active attestation and routing reports are directly relevant.
The repository is public, yet its README says the software is proprietary with all rights reserved. That alone rules it out for buyers who require open-source rights. Darkbloom documents its privacy boundary more carefully than many inference services, which makes it interesting to study. A clean security audit, stable provider admission, passing end-to-end tests, and production support would all be needed before that interesting design becomes a sensible home for sensitive workloads.